Security and data protection: your documents in good hands

If you provide instructions for use digitally, you rely on two things: the documents must remain accessible for many years, and they must not change unnoticed. At the same time, the platform processes personal data, for example of your team members and of customers who request a paper copy. This page summarises how ManualPass handles this.

Where is the data stored?

ManualPass operates its servers in Germany. Documents, account data and logs are stored there. The connection between browser and server is encrypted throughout via HTTPS – in the application as well as on the public scan page.

How is access to the application protected?

• Hashed passwords: Passwords are not stored in plain text, but only as a cryptographic hash. A hash is a one-way value from which the original password cannot be calculated back.
• Protection against brute force: Repeated failed login attempts are limited so that passwords cannot be guessed automatically.
• Roles in the team: With the roles Owner (all rights), Editor (machines, documents, paper requests) and Read only, you define who has which permissions in the account. From the Business plan, the Approver role is added. Details under Team and approval.
• Tenant separation: Each customer’s data is separated from that of other customers. An account only sees its own machine types, documents and requests.

How is the integrity of the documents secured?

Integrity means that a document exists exactly as it was uploaded. ManualPass secures it on three levels:

1. Unalterable versions: An uploaded version is not overwritten. Changes always result in a new version.
2. SHA-256 checksum: For each file, ManualPass calculates a digital fingerprint, which is also visible on the scan page.
3. Audit log with a checksum chain: Every log entry is linked to the previous one. Subsequent changes to the log become apparent.

Learn more on the Archiving page.

Four-eyes approval and audit log export

From the Business plan, you can use an approval workflow based on the four-eyes principle. A new document then only becomes public once a second authorised person has approved it; nobody can approve their own uploads. If the Approver rejects a document, they give a reason, and those involved are notified by email. This prevents a document from accidentally appearing behind the QR code without review.

From the Professional plan, the audit log can be exported as a CSV file, including the checksums. You can store the export in your own archive or present it during an audit or an enquiry from the authorities.

What data does the scan page process?

The scan page is public and can be used without a login. It does not set tracking cookies. Anyone opening or downloading instructions does not have to provide personal data.

Personal data only arises on the scan page when someone requests a paper copy. ManualPass uses these details, such as name, email and delivery address, exclusively to handle the dispatch: to notify the manufacturer, to monitor the deadline and to inform the recipient.

How is payment handled?

If you pay by credit or debit card, such as Mastercard or Visa, the payment is processed by the payment service provider Stripe. You enter the card details directly at Stripe; they are not stored at ManualPass. Alternatively, you choose to pay by invoice and transfer the amount within 14 days.

You do not need to provide any payment details for the 14-day free trial. You receive invoices automatically by email, and they are also available for download as PDFs in the customer area.

Data processing under the GDPR

When you use ManualPass, ManualPass processes personal data on your behalf, for example the details from your customers’ paper requests. You conclude the data processing agreement (DPA) online in the application under “Data protection & DPA” – without paper and without waiting. There you can also see the sub-processors, specify when details from paper requests are automatically anonymised, and find a text module for your own privacy policy. You can read the full contract text with all annexes in advance under Data processing agreement.

The privacy notice for this website can be found under Privacy.

What we do not claim

ManualPass does not currently hold any certification for information security. If your purchasing or IT department requires specific evidence, please contact us before you start. You can also review the measures yourself during the 14-day free trial, without providing payment details. We will be happy to describe how the measures listed above are implemented.